Hard-Coded JWT Secret in CyberPanel WebTerminal

Executive Summary

CyberPanel before version 3.0.0 has a hard-coded JWT secret in its WebTerminal FastAPI SSH service. This flaw allows unauthenticated remote attackers to forge valid authentication tokens and gain an interactive root shell via WebSocket on port 8888. Attackers craft a JWT signed with the hard-coded secret, setting ssh_user=root, to bypass authentication entirely.

Useful 0 Not Useful 0

Detection Guidance

Check if CyberPanel versions before 3.0.0 are installed by running: 'cyberpanel version' or checking the CyberPanel admin panel. Inspect network traffic on port 8888 for WebSocket connections to the WebTerminal service. Look for unauthorized root shell access attempts or unusual SSH connections originating from the WebTerminal service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to remotely gain root access to your server without any credentials. They can execute arbitrary commands, steal data, install malware, or disrupt services. All CyberPanel installations prior to version 3.0.0 are affected, making this a critical risk for unpatched systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized root access and potential data breaches. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A successful exploit could lead to unauthorized access, data exfiltration, or system compromise, triggering regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CyberPanel to version 3.0.0 or later immediately. If upgrading is not possible, disable the WebTerminal FastAPI SSH service by stopping the service and blocking port 8888 in the firewall. Review all active sessions and terminate any unauthorized root shells. Rotate any exposed credentials and secrets.

Useful 0 Not Useful 0